Page tree
Skip to end of metadata
Go to start of metadata

All event management policies must include the following components:

  • Event selector
  • Process(es)
  • Timeframe(s)
  • Evaluation order

Each event management policy defines selection criteria that is applied to incoming events to determine which events are processed. A timeframe determines when the policy is active or inactive. The evaluation order determines which policies are implemented first if there is a conflict.

In addition to these components, dynamic enrichment policies also require a dynamic enrichment source file, for more information about how dynamic enrichment policies interact with dynamic enrichment source files, see How dynamic enrichment event management policies work.